Subject: virtual ftp

From: "Steven K. Buehler" <[email-masked]>
Date: Thu, 13 Mar 1997 10:34:50 -0600

I hope that someone can help me with this one.  I have ftp up and running and my other problems fixed thanks to a couple of people from the list.  Now my problem is this.  I have several virtual domains on my server and some of them want their own ftp areas so that when you anonymous ftp to the site mydomain.com (the virtual domain), you won't get the main servers anonymous ftp area.  I hope that makes since.  If anybody has done this, please let me know how.  I haven't found any documentation on it and if there is some, I would be happy if someone could point me to it.  I am using wu-ftpd2.4

Thanks
Steve

======================================================
Steven K. Buehler
S & B Computers
Rockford Illinois, USA
Phone: 815-398-7169
Fax: 815-398-7266
======================================================

---

From: Kent Landfield <[email-masked]>
Date: Thu, 13 Mar 1997 11:26:26 -0600 (CST)

# 
# I hope that someone can help me with this one.  I have ftp up and 
# running and my other problems fixed thanks to a couple of people from the 
# list.  Now my problem is this.  I have several virtual domains on my server 
# and some of them want their own ftp areas so that when you anonymous ftp to 
# the site mydomain.com (the virtual domain), you won't get the main servers 
# anonymous ftp area.  I hope that makes since.  If anybody has done this, 
# please let me know how.  I haven't found any documentation on it and if 
# there is some, I would be happy if someone could point me to it.  I am 
# using wu-ftpd2.4

First, get the latest BETA version...

OK... This is not ready yet but it is a start...  I am doing this for
support locally but I will make it available in a cleaner version later.
For now it is just a dump...  If anyone wants to contribute to it or
point out my errors... ;-)  Feel free.

-- 
Kent Landfield                        Phone: 1-817-545-2502             
The Landfield Group                   FAX:   1-817-545-7650             
Email: [email-masked]             http://www.landfield.com/
Please send comp.sources.misc related mail to [email-masked].
Search the Usenet Hypertext FAQ Archive at http://www.landfield.com/faqs/
=========================================================================

Draft FAQ: Supporting Virtual Servers in WU-FTPD:

------------------------------
Subject: 1. Introduction

    So you want to setup virtual FTP servers using the same system...
    What follows are instructions for doing so.  These are not meant to
    hold your hand but they are meant to make setting it up just a bit
    easier.

------------------------------

Subject: 2. What is virtual FTP server support ?

    If you need to manage an ftp server for two separate domains, 
    you need to be able to support virtual FTP servers. Basically, 
    this allows an administrator to configure their system so a user 
    ftping to ftp1.domain.com gets one ftp banner and one ftp directory 
    and a user ftping to ftp2.domain.com gets another banner and directory 
    even though they are on the same machine and use the same ports.

------------------------------

Subject: 3. Configuring IP Address Aliases

    You have to be able to setup alias IP addresses in order for this 
    to work.  Linux and BSDI, SGI, Solaris 2.5* and other support this.  
    Check your documentation for ifconfig for your specific systems.

    For example, on Sun Solaris 2.5* systems you will need to do something 
    like the following. 

        A. Assure/place the system's normal hostname/IP address in 
           the file /etc/hostname.le0.

        B. Insert the following in the system initialization file 
           /etc/init.d/rootuser just after the if/fi test for 
           interface_names.

           #
           # configure virtual host interfaces quietly.
           #
           /sbin/ifconfig le0:1 inet XXX.XXX.XXX.XXX netmask + broadcast + \
                 -trailers up 2>&1 > /dev/null

           Replace XXX.XXX.XXX.XXX with the IP address that you wish to 
           alias.

        C. Reboot your system.  Yes, you can do it by hand but you are
           going to have to test it after a reboot anyway so why wait ?

    [ NOTE: I'd like to put in other systems info here   ]
    [ if people would be kind enough to send them to me. ]

------------------------------

Subject: 4. Setting up the directory structure for virtual server support

    You will need to setup a separate directory structure for each
    virtual server that you plan on installing.  There are various
    scripts available to assist you.  Best to grab one and customize
    it for your environment so it's easier next time.  Oh... there
    won't be a next time ?  Then do it by hand  making sure all the
    standard support directories are there (bin/etc/dev/usr/..).

------------------------------

Subject: 5. Building the software   
 
     In order to get the virtual support compiled in you will need to
     add -DVIRTUAL to the CFLAGS of the appropriate Makefile.

     Step 1: If you are adding this to a fresh copy of the server, just 
             untarred, without ever having built the software edit the
             file in src/makefiles that matches target platform you will 
             use in "build"ing it.  

               (i.e. Solaris2.x edit src/makefiles/Makefile.sol).

             If you have previously built the server then the appropriate
             makefile has been linked into the "src" directory and all you
             need to do is edit src/Makefile, add -DVIRTUAL to CFLAGS and
             then type "build clean"

     Step 2: Follow the documented build and install procedures.
 
------------------------------

Subject: 6. ftpaccess file Modifications
 
   You need to specify three separate things for each virtual server
   you setup.  

	1. "root"    - This it the path to the ftp directory that you
                       previously setup for this virtual server.

	2. "banner"  - This it the path to banner you wish displayed
                       when a user connects to the virtual server.
 
        3. "logfile" - This is the path to the logfile that is setup
                       specifically for this virtual server.

   The format of a virtual server entry is

         virtual <address> <root|banner|logfile> <path>

   <address> is the ip address of the virtual server. The second argument 
   specifies the <path> is either the path to the root of the filesystem 
   for this virtual server, the banner presented to the user when connecting
   to this virtual server, or the logfile where transfers are recorded for
   this virtual server. If the logfile is not specified the default logfile
   will be used. 

   For example, add lines similar to the following for each virtual server 
   you are trying to set up.
 
      # Virtual Server at 10.10.10.10
      virtual 10.10.10.10 root    /var/ftp/virtual/ftp-serv
      virtual 10.10.10.10 banner  /var/ftp/virtual/ftp-serv/banner.msg
      virtual 10.10.10.10 logfile /var/log/ftp/virtual/ftp-serv/xferlog

   All other message files and permissions as well as any other settings 
   in the ftpaccess file apply to all virtual servers.

   NOTE:  Your operating system may not support the virtual server feature.
          It has been tested on BSD/OS, Solaris 2.X and Linux.

------------------------------

Subject: 7. Supporting virtual logging.

    There are two different types of logging, the standard syslog logging 
    and transfer logging.  In order to separate transfer (or xferlog) 
    logging it is necessary to use the virtual "logfile" entry as described 
    above.
    
    To enable logging via syslog, follow the standard syslog configuration
    instructions found in your system's documentation.  If you have syslog 
    logging enabled you will see entries such as
    
    Mar 3 15:26:30 rkive ftpd[27207]: VirtualFTP Connect to: xxx.xxx.xxx.xxx

    This will enable you to determine which virtual server the logs 
    pertain to.
 
------------------------------

Subject: 8. Setting up other support files

    The message files need to be inside the anonymous ftp hierarchy so
    that they can be used after the chroot to the virtual server's ftp
    directory. (deny, welcome, etc.)

    You need to customize the banners and welcome messages...

------------------------------

Subject: 9. ftpaccess access information that should be supported but isn't

    It would be useful to have the "email" directive supported. Then you 
    would be able to specify %E in the banner and welcome message files.
    Today it is not supported and there is only one email directive allowed.
   
    The "guestserver" directive is not documented in the manpage. It would 
    useful to be able to use that in a virtual setup.

------------------------------

Subject: 10. Shutting down your virtual FTP servers

    At the present time use the ftpshut/ftprestart programs I put
    together.  They should appear in the baselined code in the future.

    You can grab a copy from 
		
	ftp://ftp.landfield.com/wu-ftpd/restart/restart.shar

    In order to support the proper shutting down of your server, you need to
    assure that the shutdown message file is in both the real user and 
    anonymous user ftp areas.  The location of the shutdown mesage file is 
    specified in the ftpaccess file "shutdown" directive.

    The changes to 'ftpshut.c' and the new utility 'ftprestart' implement a 
    means of shutting down the system that makes it convenient for the admin 
    and does not require that you leave unresovled sybolic links scattered 
    around your filesystems.

    ftpshut.c changes 
    ------------------

    The copy of ftpshut.c supports shutting down the server for both
    real users as well as guest accounts.  It also supports virtual
    FTP servers. 

    Configurations:
     - FTPD server setup with no anonymous ftp support and NO virtual servers 
       setup then the changes to ftpshut have no effect.  The shutdown message
       file specified in the shutdown directive is created as before.
    
     - FTPD server setup WITH anonymous ftp support and NO virtual servers 
       setup, ftpshut creates the shutdown message file at the location 
       specified in the shutdown directive and also creates the message file 
       in the anonymous FTP area.  This allows automated support for both real 
       users and guest accounts.
             
     - FTPD server setup WITH anonymous ftp support and WITH virtual servers 
       setup, ftpshut acts as above and additionally creates the shutdown
       message file in the virtual FTP directories specified in the ftpaccess
       file.  This allows shutdown support for virtual servers as well.

   ------------------ Example segment ------------------
   shutdown /etc/shutmsg
    
   # Virtual Server at 10.10.10.2 (ftp.some.domain)
   virtual 10.10.10.2 root    /servers/some.domain/ftp
   virtual 10.10.10.2 banner  /servers/some.domain/ftp/etc/msgs/banner.msg
   virtual 10.10.10.2 logfile /var/log/servers/some.domain/xferlog
    
   # Virtual Server at 10.10.10.10 (ftp.someother.domain)
   virtual 10.10.10.10 root    /servers/someother.domain/ftp
   virtual 10.10.10.10 banner  /servers/someother.domain/ftp/etc/msgs/banner.msg
   virtual 10.10.10.10 logfile /var/log/servers/someother.domain/xferlog
   ------------------ 

    Shutdown message files are created at

         /etc/shutmsg
         /servers/some.domain/ftp/etc/shutmsg
         /servers/someother.domain/ftp/etc/shutmsg

------------------------------

Subject: 11. Restarting your shutdown virtual FTP servers

    ftprestart is used when you are ready to re-enable your FTP server.
    It does the opposite of ftpshut and removes shutdown message files
    that were created by ftpshut.  It will remove the system-wide shutdown 
    message file as well as the shutdown message files in the anonymous
    ftp areas and any virtual ftp server areas.
    
    Sample output:
       ftprestart: /servers/some.domain/ftp/etc/shutmsg removed.
       ftprestart: /servers/someother.domain/ftp/etc/shutmsg removed.
       ftprestart: /etc/shutmsg removed.

------------------------------

Subject: 12. Testing your config.
 
------------------------------

Subject: 13. Quick checklist

------------------------------

Subject: 14. Disclaimer
 
   This document describes the virtual FTP server support available in
   Academ version of wu-ftpd 2.4 Release 2 Beta 10 on.  I do not warrant 
   the descriptions and instructions in this document. Use it AT YOUR OWN 
   RISK.  This is only meant as a shortcut to having to try everything to
   see what works. If it causes your computer to blow up, TOUGH! 
 
   The virtual ftp server support was initially added by Brian Kramer 
   <[email-masked]>.  Modifications to provide for discrete 
   xferlogs for each server provided by Marc G. Fournier <[email-masked]>

---

From: Michael Brennen <[email-masked]>
Date: Thu, 13 Mar 1997 10:59:28 -0600 (CST)

You need to get the latest distribution (below) and read the virtual how
in its root directory. 

   -- Michael

On Thu, 13 Mar 1997, Steven K. Buehler wrote:

> the list.  Now my problem is this.  I have several virtual domains on my
> server and some of them want their own ftp areas so that when you
> anonymous ftp to the site mydomain.com (the virtual domain), you won't
> get the main servers anonymous ftp area.  I hope that makes since.  If

This is the location for the latest wu-ftpd.  You can't see the
directory contents, but get the file anyway.  It's there.

ftp://ftp.academ.com/pub/wu-ftpd/private/wu-ftpd-2.4.2-beta-12.tar.Z

wu-ftpd FAQ:  http://www.cetis.hvu.nl/~koos/wu-ftpd-faq.html
              OR
              send mail to [email-masked]
              with a subject line: send faq

guest howto:  ftp://ftp.fni.com/pub/wu-ftpd/guest-howto
              OR
              send mail to "[email-masked]"
              (immediate autoresponder; subject does not matter)

wu-ftpd list archive:  http://www.landfield.com/wu-ftpd/mail-archive/

There are additional security references in the above docs.

---

From: "Sergei V. Rousakov" <[email-masked]>
Date: Thu, 13 Mar 1997 12:12:04 -0600 (CST)

:This is the location for the latest wu-ftpd.  You can't see the
:directory contents, but get the file anyway.  It's there.
:
:ftp://ftp.academ.com/pub/wu-ftpd/private/wu-ftpd-2.4.2-beta-12.tar.Z
:

I believe that
 
ftp://ftp.academ.com/pub/wu-ftpd/private/wu-ftpd-2.4.2-beta-13.tar.Z

is out.  At least it is what I found there.

-Sergei

---

From: "Sergei V. Rousakov" <[email-masked]>
Date: Thu, 13 Mar 1997 12:09:25 -0600 (CST)

On Thu, 13 Mar 1997, Kent Landfield wrote:

:=========================================================================
:
:Draft FAQ: Supporting Virtual Servers in WU-FTPD:
:

[snip] [snip] [snip]

:------------------------------
:
:Subject: 3. Configuring IP Address Aliases
:
:    You have to be able to setup alias IP addresses in order for this 
:    to work.  Linux and BSDI, SGI, Solaris 2.5* and other support this.  
:    Check your documentation for ifconfig for your specific systems.
[snip]
:
:    [ NOTE: I'd like to put in other systems info here   ]
:    [ if people would be kind enough to send them to me. ]
:

Configuring IP Aliases on SGI:

1. Login as root
2. edit /etc/hosts to include IP address and the name of the virtual server
3. edit /etc/config/ipaliases.options using comments in that file as a
template: 

ec0 192.111.26.51 netmask 0xffffff00 broadcast 192.111.26.255

or

ec0 foobar netmask 0xffffff00 broadcast 192.111.26.255

4.  /etc/chkconfig -f ipaliases on
5. reboot

6. use netstat or ping to check if it is running.

---

From: "Steven K. Buehler" <[email-masked]>
Date: Thu, 13 Mar 1997 13:23:06 -0600

Thanks to Kent and the rest of you that replied to me on this.  Your help was greatly appreciated and I have now got it up and running perfectly.

Thanks
Steve

---

From: "Karl O. Pinc" <[email-masked]>
Date: Thu, 13 Mar 1997 13:32:08 -0600

>    useful to be able to use that in a virtual setup.

I've a way you can use virtual ftp and support the

e-mail directive

upload directive (very useful for setting ownership and permissions)

& probably guestserver (I'm not familar with that one) and lots of other
directives too, (different classes, etc., I'm using the e-mail and upload
directives on my virtual ftp servers.)

Instructions (a little loose for an exact step by step, but it's a start):

Read all of these instructions before starting.

Get the ftpaccess patch from
ftp://ftp.meme.com/pub/software/wu-ftpd-2.4.2/.  It's there as a tar file,
a gzipped tar file, a rpm file, and just a directory with the patch and a
README.  (I haven't tried this patch with beta 12 or beta 13, it works on
beta 11.  Contact me if you have any problems in later releases and I'll
fix it.)  Read the README and put the patch in with patch.

Recompile and re-install wu-ftpd.

You now have a ftpd that will take an argument to -a, the path to the
ftpaccess file.

Get a copy of tcpwrappers (one can be found at
ftp://coast.cs.purdue.edu/pub/tools/unix/tcp_wrappers.  I'd like to know
the offical distribution point, but haven't taken the time to find it.  If
you know, drop me a note.).  (Every system providing services to the net
should have a copy of this anyhow.)  Read the directions.  Compile it with
full options so the TWIST command will work.  Install it.  (If you're using
Redhat Linux, it comes with tcpwrappers ready to go.)

Configure your virtual servers: Make /etc/ftpaccess a directory, put
different ftpaccess files into it, using file names of your choosing.
Remove the virtual directives and anything else needed by the virtual
servers from the old /etc/ftpaccess file and move it into /etc/ftpaccess.
Each virtual server can have it's own ftpaccess file, or they can share.
The different ftpaccess files can contain completly different sets of
directives as each configuration file can configure a single virtual
server.  The ftpaccess file of a virtual server dosen't need to have any
configuration directives not used by that virtual server, so it dosen't
need virtual commands for any of the other virtual servers and it dosen't
need class directives or whatnot used only by the regular ftp server.

Use tcpwrappers to give ftpd a different command line for each virtual
server, directing each virtual server to the appropritate ftpaccess file:

Modify /etc/inetd.conf to invoke tcpwrapper.  On my system the new line for
the ftp port looks like:

ftp     stream  tcp     nowait  root    /usr/sbin/tcpd  /usr/local/sbin/ftpd

Add a line to /etc/hosts.allow for the real ftp server and for each virtual
ftp server.  Use the -a option to tell ftpd which ftpaccess file to use for
each server.  On my system a typical line looks like:

[email-masked] : ALL : twist exec /usr/local/sbin/ftpd -l -a
/etc/ftpacces
s/x.meme.com

Note that the ip number is the ip number used by the ftp server, the same
as that in the ftpaccess virtual directive.

Note: with an "ftproot" directive to tell the ftp server a path to use as
root for anonymous ftp access, the virtual directives become completely
unnecessary.  This would be handy because it would reduce the spattering of
ip numbers about the system (and simplfy the ftpd code.)

Karl

May the Legos (TM) always be swept from your path in the night.

---

From: "Sergei V. Rousakov" <[email-masked]>
Date: Thu, 13 Mar 1997 13:43:16 -0600 (CST)

: probably guestserver (I'm not familar with that one) and lots of other
:directives too, (different classes, etc., I'm using the e-mail and upload

As for guestserver:

>From ftpd.c source:
        /*
        ** Algorithm used: 
        ** - if no "guestserver" directive is present, -- Sergei Rousakov,
        ** anonymous access is allowed, for backward compatibility. 
        ** - if a "guestserver" directive is present,
        ** anonymous access is restricted to the machines listed,
        ** usually the machine whose CNAME on the current domain
        ** is "ftp"... 
        **
        ** the format of the "guestserver" line is
        ** guestserver [<machine1> [<machineN>]]
        ** that is, "guestserver" will forbid anonymous access on all
								machines
        ** while "guestserver ftp inf" will allow anonymous access on
        ** the two machines whose CNAMES are "ftp.enst.fr" and
								"inf.enst.fr". 
        **
        ** if anonymous access is denied on the current machine,
        ** the user will be asked to use the first machine listed (if any) 
        ** on the "guestserver" line instead: 
        ** 530- Guest login not allowed on this machine,
        ** connect to ftp.enst.fr instead. 
        **
        ** -- <[email-masked]>
        */

You need just add guestserver to your ftpaccess file.

-Sergei

--
Sergei Rousakov, Computer Systems Analyst  Email: [email-masked]
Microcomputer Lab, College of A&S          Phone: (615)343-4129
Vanderbilt University                      Fax: (615)322-4977

---

From: "Richard L. Goerwitz" <[email-masked]>
Date: Thu, 13 Mar 1997 15:24:45 -0500

Could you maybe re-post to the list directions, telling us what you did?

-- 

Richard Goerwitz
PGP key fingerprint:    C1 3E F4 23 7C 33 51 8D  3B 88 53 57 56 0D 38 A0
For more info (mail, phone, fax no.):  finger [email-masked]

---

From: Kent Landfield <[email-masked]>
Date: Thu, 13 Mar 1997 14:36:40 -0600 (CST)

Thanks Sergei.  It's been added. 

# :Draft FAQ: Supporting Virtual Servers in WU-FTPD:

# :Subject: 3. Configuring IP Address Aliases
# :
# :    You have to be able to setup alias IP addresses in order for this 
# :    to work.  Linux and BSDI, SGI, Solaris 2.5* and other support this.  
# :    Check your documentation for ifconfig for your specific systems.
# [snip]
# :
# :    [ NOTE: I'd like to put in other systems info here   ]
# :    [ if people would be kind enough to send them to me. ]